Web endpoint device having automatic switching between proxied and non-proxied communication modes

1. A computer-implemented method comprising:

initiating a web transaction between an endpoint device and a target web server, the endpoint device comprising a switching logic module, a communication performance monitor, a proxy connected endpoint system and a direct-connect endpoint system, the proxy connected endpoint system comprising an intermediate proxy server, the web transaction being subject to security policies respectively implemented at the proxy connected endpoint system and the direct-connect endpoint system;

monitoring, via the communication performance monitor, one or more communication performance conditions associated with conducting the web transaction;

automatically switching, via the switching logic module, between a first communication mode and a second communication mode in response to the one or more communication performance conditions associated with conducting the web transaction, wherein

the endpoint device communicates with the target web server using the intermediate proxy server of the proxy connected endpoint system in the first communication mode; and

the endpoint device communicates with the target web server without using the intermediate proxy server in the second communication mode, when communicating in the second communication mode, the endpoint device communicating with the target web server via the direct-connect endpoint system.

2. The computer-implement method of claim 1 , wherein the communication performance conditions include one or more network communication performance conditions including:

a change in availability of a network used in the web transaction;

whether the endpoint device is using a virtual private network for communication with the target web server;

network communication speed between the endpoint device and the target web server;

communication latency between the endpoint device and the target web server;

a quality of service condition of the communications between the endpoint device and the target web server;

network communication speed between the endpoint device and a secured web gateway server;

communication latency between the endpoint device and the secured web gateway server; and

a quality of service condition of the communications between the endpoint device and the secured web gateway server.

3. The computer-implemented method of claim 2 , wherein the endpoint device automatically switches to the second communication mode under one or more conditions, including:

the network used in the web transaction in the first communication mode is no longer available;

the endpoint device is using a virtual private network for communication with the target web server;

the network communication speed between the endpoint device and the target web server falls below a threshold; or

the quality of service of communications between the endpoint device and the target web server falls below a threshold.

4. The computer-implemented method of claim 1 , wherein the second communication mode includes

establishing a side channel to a security service when the endpoint device initiates the web transaction with a web-enabled application; and

using the side channel to enforce a security policy at the endpoint device, wherein the security policy is stored at the security service.

5. The computer-implemented method of claim 1 , further comprising:

generating data at a web-enabled application at the endpoint device for communication to the target web server;

intercepting the data from the web-enabled application at a switching logic module;

determining a status of the one or more communication performance conditions;

in response to determining that the one or more communication performance conditions indicate use of the first communication mode,

forwarding the intercepted data from the switching logic module to the proxy server for communication to the target web server; and

in response to determining that the one or more communication performance conditions indicate use of the second communication mode.

6. The computer-implemented method of claim 5 , further comprising:

in response to determining that the one or more communication performance conditions

indicate use of the second communication mode,

establishing a side channel to a security service,

receiving a security policy from the security service at the endpoint device over the side channel, and

enforcing the security policy at the endpoint device to control communications between the endpoint device and the target web server.

7. The computer-implemented method of claim 6 , further comprising:

selectively forwarding the intercepted data from the switching logic module to the target web server based on the security policy enforced at the endpoint device.

8. A system comprising:

one or more processing units each including

one or more processors,

memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors,

the one or more processing units, alone or in combination with one another, execute the program instructions to perform a method comprising:

initiating a web transaction between an endpoint device and a target web server, the endpoint device comprising a switching logic module, a communication performance monitor, a proxy connected endpoint system and a direct-connect endpoint system, the proxy connected endpoint system comprising an intermediate proxy server, the web transaction being subject to security policies respectively implemented at the proxy connected endpoint system and the direct-connect endpoint system;

monitoring, via the communication performance monitor, one or more communication performance conditions associated with conducting the web transaction;

automatically switching, via the switching logic module, between a first communication mode and a second communication mode in response to the one or more communication performance conditions associated with conducting the web transaction, wherein

the endpoint device communicates with the target web server using the intermediate proxy server of the proxy connected endpoint system in the first communication mode; and

the endpoint device communicates with the target web server without using the intermediate proxy server in the second communication mode, when communicating in the second communication mode, the endpoint device communicating with the target web server via the direct-connect endpoint system.

9. The system of claim 8 , wherein the communication performance conditions include one or more network communication performance conditions including:

a change in availability of a network used in the web transaction;

whether the endpoint device is using a virtual private network for communication with the target web server;

network communication speed between the endpoint device and the target web server;

communication latency between the endpoint device and the target web server;

a quality of service condition of the communications between the endpoint device and the target web server;

network communication speed between the endpoint device and a secured web gateway server;

communication latency between the endpoint device and the secured web gateway server; and

a quality of service condition of the communications between the endpoint device and the secured web gateway server.

10. The system of claim 9 , wherein the endpoint device automatically switches to the second communication mode under one or more conditions, including:

the network used in the web transaction in the first communication mode is no longer available;

the endpoint device is using a virtual private network for communication with the target web server;

the network communication speed between the endpoint device and the target web server falls below a threshold; and

the quality of service of communications between the endpoint device and the target web server falls below a threshold.

11. The system of claim 8 , wherein

the second communication mode includes

establishing a side channel to a security service when the endpoint device initiates the web transaction with a web-enabled application; and

using the side channel to enforce a security policy at the endpoint device, wherein the security policy is stored at the security service.

12. The system of claim 8 , wherein the method further comprises:

generating data at a web-enabled application at the endpoint device for communication to the target web server;

intercepting the data from the web-enabled application at a switching logic module;

determining a status of the one or more communication performance conditions;

in response to determining that the one or more communication performance conditions indicate use of the first communication mode,

forwarding the intercepted data from the switching logic module to the proxy server for communication to the target web server; and

in response to determining that the one or more communication performance conditions indicate use of the second communication mode,

forwarding the intercepted data from the switching logic module to the target web server, wherein the forwarded data from the switching logic module bypasses the proxy server.

13. The system of claim 12 , wherein the method further comprises:

in response to determining that the one or more communication performance conditions indicate use of the second communication mode,

establishing a side channel to a security service,

receiving a security policy from the security service at the endpoint device over the side channel;

enforcing the security policy at the endpoint device to control communications between the endpoint device and the target web server.

14. The system of claim 13 , wherein the method further comprises:

selectively forwarding the intercepted data from the switching logic module to the target web server based on the security policy enforced at the endpoint device.

15. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer-executable instructions configured for:

initiating a web transaction between an endpoint device and a target web server, the endpoint device comprising a switching logic module, a communication performance monitor, a proxy connected endpoint system and a direct-connect endpoint system, the proxy connected endpoint system comprising an intermediate proxy server, the web transaction being subject to security policies respectively implemented at the proxy connected endpoint system and the direct-connect endpoint system;

monitoring, via the communication performance monitor, one or more communication performance conditions associated with conducting the web transaction;

automatically switching, via the switching logic module, between a first communication mode and a second communication mode in response to the one or more communication performance conditions associated with conducting the web transaction, wherein

the endpoint device communicates with the target web server using the intermediate proxy server of the proxy connected endpoint system in the first communication mode; and

the endpoint device communicates with the target web server without using the intermediate proxy server in the second communication mode, when communicating in the second communication mode, the endpoint device communicating with the target web server via the direct-connect endpoint system.

16. The non-transitory, computer-readable storage medium of claim 15 , wherein the communication performance conditions include one or more network communication performance conditions including:

a change in availability of a network used in the web transaction;

whether the endpoint device is using a virtual private network for communication with the target web server;

network communication speed between the endpoint device and the target web server;

communication latency between the endpoint device and the target web server;

a quality of service condition of the communications between the endpoint device and the target web server;

network communication speed between the endpoint device and a secured web gateway server;

communication latency between the endpoint device and the secured web gateway server; and

a quality of service condition of the communications between the endpoint device and the secured web gateway server.

17. The non-transitory, computer-readable storage medium of claim 16 , wherein the endpoint device automatically switches to the second communication mode under one or more conditions, including:

the network used in the web transaction in the first communication mode is no longer available;

the endpoint device is using a virtual private network for communication with the target web server;

the network communication speed between the endpoint device and the target web server falls below a threshold; or

the quality of service of communications between the endpoint device and the Target web server falls below a threshold.

18. The non-transitory, computer-readable storage medium of claim 15 , wherein

the second communication mode includes

establishing a side channel to a security service when the endpoint device initiates the web transaction with a web-enabled application; and

using the side channel to enforce a security policy at the endpoint device, wherein the security policy is stored at the security service.

19. The non-transitory, computer-readable storage medium of claim 15 , wherein the instructions are further configured for:

generating data at a web-enabled application at the endpoint device for communication to the target web server;

intercepting the data from the web-enabled application at a switching logic module;

determining a status of the one or more communication performance conditions;

in response to determining that the one or more communication performance conditions indicate use of the first communication mode,

forwarding the intercepted data from the switching logic module to the proxy server for communication to the target web server; and

in response to determining that the one or more communication performance conditions indicate use of the second communication mode,

forwarding the intercepted data from the switching logic module to the target web server, wherein the forwarded data from the switching logic module bypasses the proxy server.

20. The non-transitory, computer-readable storage medium of claim 19 , wherein the instructions are further configured for:

in response to determining that the one or more communication performance conditions

indicate use of the second communication mode,

establishing a side channel to a security service,

receiving a security policy from the security service at the endpoint device over the side channel;

enforcing the security policy at the endpoint device to control communications between the endpoint device and the target web server; and

selectively forwarding the intercepted data from the switching logic module to the target web server based on the security policy enforced at the endpoint device.